Client confidences, and nobody whose job this is.
The obligation came with the practice, not with the headcount.
The ABA Model Rules ask a lawyer to make reasonable efforts to prevent unauthorized access to, or inadvertent disclosure of, information relating to the representation of a client (Model Rule 1.6(c)). Your state's version of that rule is the one that binds you, and your bar is the authority on what it requires. What the rule does not do is ask how many people work at your firm.
At five to ten people, reasonable effort has usually meant whoever is best with computers, plus a company that comes out when something breaks. That covers the laptop that will not print. It does not cover a mailbox forwarding rule nobody set, a departed associate whose account is still live, or the question your insurer asks every year about multi-factor authentication.
Four things, run for you, on a schedule.
Microsoft 365, configured properly
Business Premium already includes conditional access, Defender for Business, and device management. Most firms license all of it and switch on a fraction. We turn on what you already pay for, then keep it configured as Microsoft changes the defaults underneath it.
How Microsoft 365 gets hardenedEvery laptop and phone accounted for
Managed endpoints with encryption, protection that reports centrally, and the ability to wipe a device remotely. A partner's laptop in the back of a rideshare becomes a phone call rather than a notification obligation.
What managed IT coversYour firm's name in the inbox
Mail authentication set up so a message claiming to come from your firm cannot be delivered by someone else, and a watch on the domain names close enough to yours to fool a client mid-transaction.
What stays under watchPeople arriving and leaving
An associate joining gets exactly the access the role needs on day one. An associate leaving loses all of it the day they go, with a record of when it happened and who approved it.
How joiners and leavers workThe application asks the same questions every year.
Cyber cover is where most small firms first meet these questions in writing, and the answers are signed by a partner. When the controls are operated rather than assumed, every answer is one you can show, and the evidence behind it is already filed.
We fill in the technical sections with you, and we tell you plainly where an answer would be no.
How insurance readiness works- Is multi-factor authentication enforced on email for every user?
- Are backups held separately and tested?
- Are staff trained on phishing, and can you show it?
- Is access removed the day someone leaves?
- Do you have a written incident response plan?
What we are not.
We do not sell or run practice management, document management, e-discovery, or trust accounting software. Those stay with the vendors you already chose, and we will work alongside them on access and integration. What we run is the Microsoft 365 tenant, the devices, the identities, and the security around all three.
We run five platforms and know all five completely. That is the reason we can give a small firm a finish date rather than an open-ended arrangement.
Where the evidence lives
One place to look when someone asks what you do about security.
Access reviews, device status, the incident response plan, and the records behind them sit in the platform, ready for the carrier's form or a client's own security questions.
Tell us what your firm runs today.
Thirty minutes, and we will tell you what we can see from the outside before anything is signed.
Published structure with an entry rung you can start today, sized for a firm of this size rather than a department.
A conversation about what you run now, what your carrier asks, and what it would take to answer all of it.